Abstract: Systems and methods are provided for implementing a multi-service file system for a hosted computing instance via a locally-addressable secure compute layer. Software within the instance can submit file operations to the secure compute layer, which the secure compute layer can translate into calls to one or more network-accessible storage services. To provide a multi-service file system, the secure compute layer can obtain mapping data mapping file system objects within the virtualized file system to different network-accessible storage services. On receiving a file operation, the secure compute layer can determine one or more network-accessible storage services corresponding to the file operation, and submit appropriate calls to the one or more network-accessible storage services.

Abstract: Systems and methods for efficient and secure management of encrypted “snapshots” for a remote provider substrate extension (“PSE”) of a cloud provider network substrate are provided. The PSE may request and obtain a snapshot from the cloud provider network substrate, restore a volume from the snapshot, make changes to data in the restored volume, and/or initiate the creation and storage of a new snapshot that includes incremental updates to the original snapshot to reflect the changes made to data in the volume. An encrypted snapshot stored within the cloud provider network substrate may be decrypted using a cloud provider key designed for internal use only, and then re-encrypted using a PSE-specific key before providing the snapshot to the PSE, thereby avoiding the sharing of the cloud provider internal use only key outside the cloud provider network substrate.

Abstract: A first block storage server virtual machine to host a first volume using one or more storage devices of a computer system is executed by the computer system. A second virtual machine having access to a virtual block storage device is executed by the computer system. A block storage client is executed by the computer system. A first block storage operation is received by the block storage client from the second virtual machine, the first block storage operation to perform on the virtual block storage device. A message is sent by the block storage client to the first block storage server virtual machine to cause the first block storage server virtual machine to perform the block storage operation with the first volume.

Abstract: One or more configuration parameters for an object gateway instance are received at an interface to a provider network, the parameters including an identifier of a first object store of the provider network for which to cache objects in a first object cache of the object gateway instance and an indication of a data transfer mode that controls when objects written to the first object cache are written to the first object store. The one or more configuration parameters are stored in a data store of the provider network and sent to the object gateway instance. A read request that includes the identifier of the first object store and a first object identifier is received from the object gateway instance, and a first object associated with the first object identifier and stored in the first object store is sent to the object gateway instance.

Abstract: A data storage manager may manage storage locations for blocks of a storage volume. The blocks of the storage volume may be assigned to a logical volume exposed to a computing instance supported by a host. Furthermore, the data storage manager may also generate and maintain a set of rules that specify the locations of blocks of the storage volume, and provides the set of rules to the host. The set of rules may be included in a data structure enabling the host to access the blocks based at least in part on the information included in the set of rules.

Abstract: Security can be provided for data stored using resources that are deployed in an environment managed by a third party. Physical and logical detection mechanisms can be used to monitor various security aspects, and the resulting security data can be used to identify potential threats to these resources. In some embodiments, suspicious activity can cause resources such as data servers to be automatically and remotely rebooted such that keys stored in volatile memory on those data servers will be lost from those servers, such that an attacker will be unable to decrypt data stored on those servers. Once a determination of safety is made, the keys can be provided to the respective data servers such that data operations can resume.

Abstract: Systems and methods are provided for providing a consistent experience for users of cloud-based block storage volumes. While cloud storage aims to remove hardware considerations for an end user's experience, block storage performance can nevertheless vary according to hardware configuration, such as the specific model of underlying hardware used to support a volume or the specific network location of that hardware. Embodiments of the present disclosure address that inconsistent performance by associating a volume with a performance profile, which can represent a desired distribution of performance for the volume. Each read or write can be compared to the profile, and may be selectively delayed to match the desired performance. This enables the cloud provider to vary physical hardware or network configurations without effect on block storage performance from the point of view of an end user.

Abstract: A first one or more messages is received, the one or more messages including a request for a storage expansion device for an extension of a provider network, an identifier of the extension of the provider network, and a set of one or more identifiers associated with objects to load to the storage expansion device. For each identifier in the set, an object associated with the identifier is copied from an object store of the provider network to the storage expansion device. A shipment of the storage expansion device to a specified location is initiated. The extension of the provider network is caused to launch an instance to communicate with the storage expansion device upon connection of the storage expansion device to the extension of the provider network.

Abstract: A user can set or modify operational parameters of a data volume stored on a network-accessible storage device in a data center. For example, the user may be provided access to a data volume and may request a modification to the operational parameters of the data volume. Instead of modifying the existing data volume, the data center can provision a new data volume and migrate data stored on the existing data volume to the new data volume. While the data migration takes place, the existing data volume may block input/output (I/O) requests and the new data volume may handle such requests instead. Once the data migration is complete, the data center may deallocate the data blocks of the existing data volume such that the data blocks can be reused by other data volumes.

Abstract: A distributed system may implement identifying correlated workloads for resource allocation. Resource data for resources hosted at resource hosts in a distributed system may be analyzed to determine behavioral similarities. Historical behavior data or resource configuration data, for instance, may be compared between resources. Behaviors between resources may be identified as correlated according to the determined behavioral similarities. An allocation of one or more resource hosts in the distributed system may be made for a resource based on the behaviors identified as correlated. For instance, resources may be migrated from a current resource host to another resource host, new resources may be placed at a resource host, or resources may be reconfigured into different resources. Machine learning techniques may be implemented to refine techniques for identifying correlated behaviors.

Abstract: Techniques are described for using in-band communication channels to exchange state information between components of a distributed storage environment, including between client computing devices and storage servers hosting network-connected block storage volumes. The exchange of the state information can be used, for example, to inform client computing devices of relevant events involving one or more storage volumes attached to compute instances (for example, virtual machines (VMs)) running on the client computing devices, involving one or more failover servers storing backup copies of one or more storage volumes, or involving any other relevant system components.

Abstract: Memory is identified for a first set of histogram buckets for a metric with bucket value ranges distributed according to a first function, and a second set of histogram buckets with bucket value ranges distributed according to a second function. The second set of buckets overlaps with a metric value range targeted for enhanced granularity analysis. After the histogram is updated in response to obtaining metric values, a representation of at least some of the buckets is sent to a destination.

Abstract: Methods, systems, and computer-readable media for program code allocation based on processor features are disclosed. Analysis of program code is performed using static analysis and/or runtime analysis. The analysis determines one or more processor features invoked by the program code. One or more program execution servers are selected from a plurality of program execution servers based at least in part on the one or more processor features invoked by the program code. One or more selected program execution servers comprise the one or more processor features invoked by the program code, and an additional one or more of the program execution servers lack the one or more processor features invoked by the program code. The program code is executed using the one or more selected program execution servers.

Abstract: One or more configuration parameters for an object gateway instance are received at an interface to a provider network, the parameters including an identifier of a first object store of the provider network for which to cache objects in a first object cache of the object gateway instance and an indication of a data transfer mode that controls when objects written to the first object cache are written to the first object store. The one or more configuration parameters are stored in a data store of the provider network and sent to the object gateway instance. A read request that includes the identifier of the first object store and a first object identifier is received from the object gateway instance, and a first object associated with the first object identifier and stored in the first object store is sent to the object gateway instance.

Abstract: Aspects relate to a framework for utilizing a single API request to manage the creation of consistent snapshots for a set of volumes attached an individual instance in a distributed computing environment. Responsive to receipt of an API request identifying the instance, the multi-volume snapshot service identifies a set of volumes attached to the identified instance. The identified set of volumes can be processed or filtered to eliminate specific volumes or types of volumes, such as boot volumes. In the event that any snapshot creation attempt fails, the multi-volume snapshot service fails the API request and can delete any snapshot data generated prior to the failure.

Abstract: Generally described, one or more aspects of the present application correspond to techniques for automatic recovery from dual isolation in which both the primary and secondary replicas of a volume are stored on isolating servers. The disclosed techniques use handshakes between the client and the replicas to determine which has a better health score. The replica with the better health score becomes the primary replica, and confirms that it and the secondary replica are both in an isolating state. In response, the primary replica seeks a solo blessing, undoes the isolating state at the volume level (the server host will still be in isolating state), and continues handling I/O and peer replication until its healthy peer is complete. These techniques can avoid availability drops when the servers hosting the primary and secondary replicas of a volume enter the isolating state at around the same time.

Abstract: A first block storage server virtual machine to host a first volume using one or more storage devices of a computer system is executed by the computer system. A second virtual machine having access to a virtual block storage device is executed by the computer system. A block storage client is executed by the computer system. A first block storage operation is received by the block storage client from the second virtual machine, the first block storage operation to perform on the virtual block storage device. A message is sent by the block storage client to the first block storage server virtual machine to cause the first block storage server virtual machine to perform the block storage operation with the first volume.

Abstract: A first request to create a first storage volume to store a first portion of a first logical volume is received by a first block storage server instance. A second request to create a second storage volume to store a second portion of the first logical volume is received by a second block storage server instance. A third request is sent to a third block storage server instance to create a third storage volume to store the second portion of the first logical volume. The second portion of the first logical volume is stored by the third block storage server instance to the third storage volume. A data store containing an identification of each block storage server instance hosting a portion of the first logical volume is updated to remove an identification of the second block storage server instance and add an identification of the third block storage server instance.

Abstract: A first request to launch a first virtual machine to host a block storage server application is received. At least a portion of a storage capacity of one or more storage devices of a host computer system is provisioned to the first virtual machine as a provisioned storage device. The block storage server application is executed with the first virtual machine. As part of executing the block storage server application, a logical volume is created on the provisioned storage device in response to a second request from a block storage service of a provider network to create the logical volume, a third request to perform an input/output operation is received and performed with the logical volume.

Abstract: Notice of migration of a portion of a data volume from a first location to a second location is received by a first computer system from a second computer system, where the data volume is separated over a network from the first computer system. A third computer system, separated over a network from the first computer system, is caused to invalidate a mapping between the portion and the first location. An indication that the third computer system seeks access to the portion is identified. A third computer system is enabled, by providing a mapping between the portion and the second location, to access portion at the second location.